text:
Consumer Privacy Fund

(a) (1) A special fund to be known as the “Consumer Privacy Fund” is hereby created within the General Fund in the State Treasury, and is available upon appropriation by the Legislature.

(2) Funds in the Consumer Privacy Fund and all subfunds within the fund shall be used exclusively for the purposes described in this section and shall not be subject to appropriation or transfer by the Legislature for any other purpose. Any interest and earnings from the fund and all subfunds within the fund shall be transferred on an annual basis to the State Treasury to be available in the General Fund for appropriation by the Legislature.

(b) (1) The Consumer Privacy Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision.

(2) Ninety-five percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Subfund and shall be used exclusively by the California Privacy Protection Agency in carrying out its duties under this title.

(c) (1) The Attorney General Consumer Privacy Enforcement Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Attorney General Consumer Privacy Enforcement Subfund shall be used exclusively for the purposes described in this subdivision.

(2) Ninety-five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Attorney General Consumer Privacy Enforcement Subfund and shall be used exclusively by the Attorney General in carrying out its duties under this title.

(d) The Consumer Privacy Grant Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision.

(1) (A) Five percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund.

(B) Five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund.

(2) (A) Funds deposited into the Consumer Privacy Grant Subfund shall be used exclusively by the California Privacy Protection Agency to administer and distribute grants to promote and protect consumer privacy, educate children in the area of online privacy, and fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches.

(B) Subject to subparagraph (A), the California Privacy Protection Agency shall make grants from the Consumer Privacy Grant Subfund by distributing one-third of the amount allocated for grant funding in the subfund to each of the following grant recipients:

(i) Nonprofit organizations to promote and protect consumer privacy.

(ii) Nonprofit organizations and public agencies, including school districts, to educate children in the area of online privacy.

(iii) State and local law enforcement agencies to fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches.

(3) (A) The California Privacy Protection Agency shall begin administering the grant program described in paragraph (2) when the amount of funds in the Consumer Privacy Grant Subfund exceeds three hundred thousand dollars ($300,000).

(B) In a fiscal year in which the amount of funds in the Consumer Privacy Grant Subfund is equal to or less than three hundred thousand dollars ($300,000), the funds shall remain in the Consumer Privacy Grant Subfund until the total funds exceed three hundred thousand dollars ($300,000).

(e) Any remaining funds in the Consumer Privacy Fund and subfunds within the fund that were not appropriated as part of the 2025 Budget Act shall be transferred on a one-time basis in the 2025–26 fiscal year as follows:

(1) Forty-five percent of the remaining funds shall be transferred to the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b).

(2) Forty-five percent of the remaining funds shall be transferred to the Attorney General Consumer Privacy Enforcement Subfund created within the Consumer Privacy Fund pursuant to subdivision (c).

(3) Ten percent of the remaining funds shall be transferred to the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.

history: (History: Amended by Stats. 2025, Ch. 20, Sec. 2. (AB 137) Effective June 30, 2025.)


kind: section

code: CIV

text:
Conflicting Provisions

This title is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers’ personal information, including, but not limited to, Chapter 22 (commencing with Section 22575) of Division 8 of the Business and Professions Code and Title 1.81 (commencing with Section 1798.80). The provisions of this title are not limited to information collected electronically or over the Internet, but apply to the collection and sale of all personal information collected by a business from consumers. Wherever possible, law relating to consumers’ personal information should be construed to harmonize with the provisions of this title, but in the event of a conflict between other laws and the provisions of this title, the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 19. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)

title: 1.81.5. California Consumer Privacy Act of 2018


text:
Preemption

This title is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, city and county, municipality, or local agency regarding the collection and sale of consumers’ personal information by a business.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 20. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)

path: 1.81.5. California Consumer Privacy Act of 2018


text:
Regulations

(a) On or before July 1, 2020, the Attorney General shall solicit broad public participation and adopt regulations to further the purposes of this title, including, but not limited to, the following areas:

(1) Updating or adding categories of personal information to those enumerated in subdivision (c) of Section 1798.130 and subdivision (v) of Section 1798.140, and updating or adding categories of sensitive personal information to those enumerated in subdivision (ae) of Section 1798.140 in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.

(2) Updating as needed the definitions of “deidentified” and “unique identifier” to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and adding, modifying, or deleting categories to the definition of designated methods for submitting requests to facilitate a consumer’s ability to obtain information from a business pursuant to Section 1798.130. The authority to update the definition of “deidentified” shall not apply to deidentification standards set forth in Section 164.514 of Title 45 of the Code of Federal Regulations, where such information previously was “protected health information” as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.

(3) Establishing any exceptions necessary to comply with state or federal law, including, but not limited to, those relating to trade secrets and intellectual property rights, within one year of passage of this title and as needed thereafter, with the intention that trade secrets should not be disclosed in response to a verifiable consumer request.

(4) Establishing rules and procedures for the following:

(A) To facilitate and govern the submission of a request by a consumer to opt out of the sale or sharing of personal information pursuant to Section 1798.120 and to limit the use of a consumer’s sensitive personal information pursuant to Section 1798.121 to ensure that consumers have the ability to exercise their choices without undue burden and to prevent business from engaging in deceptive or harassing conduct, including in retaliation against consumers for exercising their rights, while allowing businesses to inform consumers of the consequences of their decision to opt out of the sale or sharing of their personal information or to limit the use of their sensitive personal information.

(B) To govern business compliance with a consumer’s opt-out request.

(C) For the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt out of the sale of personal information.

(5) Establishing rules, procedures, and any exceptions necessary to ensure that the notices and information that businesses are required to provide pursuant to this title are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer, including establishing rules and guidelines regarding financial incentives within one year of passage of this title and as needed thereafter.

(6) Establishing rules and procedures to further the purposes of Sections 1798.105, 1798.106, 1798.110, and 1798.115 and to facilitate a consumer’s or the consumer’s authorized agent’s ability to delete personal information, correct inaccurate personal information pursuant to Section 1798.106, or obtain information pursuant to Section 1798.130, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a business’ determination that a request for information received from a consumer is a verifiable consumer request, including treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a consumer who does not maintain an account with the business to request information through the business’ authentication of the consumer’s identity, within one year of passage of this title and as needed thereafter.

(7) Establishing how often, and under what circumstances, a consumer may request a correction pursuant to Section 1798.106, including standards governing the following:

(A) How a business responds to a request for correction, including exceptions for requests to which a response is impossible or would involve disproportionate effort, and requests for correction of accurate information.

(B) How concerns regarding the accuracy of the information may be resolved.

(C) The steps a business may take to prevent fraud.

(D) If a business rejects a request to correct personal information collected and analyzed concerning a consumer’s health, the right of a consumer to provide a written addendum to the business with respect to any item or statement regarding any such personal information that the consumer believes to be incomplete or incorrect. The addendum shall be limited to 250 words per alleged incomplete or incorrect item and shall clearly indicate in writing that the consumer requests the addendum to be made a part of the consumer’s record.

(8) Establishing the standard to govern a business’ determination, pursuant to subparagraph (B) of paragraph (2) of subdivision (a) of Section 1798.130, that providing information beyond the 12-month period in a response to a verifiable consumer request is impossible or would involve a disproportionate effort.

(9) Issuing regulations further defining and adding to the business purposes, including other notified purposes, for which businesses, service providers, and contractors may use consumers’ personal information consistent with consumers’ expectations, and further defining the business purposes for which service providers and contractors may combine consumers’ personal information obtained from different sources, except as provided for in paragraph (6) of subdivision (e) of Section 1798.140.

(10) Issuing regulations identifying those business purposes, including other notified purposes, for which service providers and contractors may use consumers’ personal information received pursuant to a written contract with a business, for the service provider or contractor’s own business purposes, with the goal of maximizing consumer privacy.

(11) Issuing regulations to further define “intentionally interacts,” with the goal of maximizing consumer privacy.

(12) Issuing regulations to further define “precise geolocation,” including if the size defined is not sufficient to protect consumer privacy in sparsely populated areas or when the personal information is used for normal operational purposes, including billing.

(13) Issuing regulations to define the term “specific pieces of information obtained from the consumer” with the goal of maximizing a consumer’s right to access relevant personal information while minimizing the delivery of information to a consumer that would not be useful to the consumer, including system log information and other technical data. For delivery of the most sensitive personal information, the regulations may require a higher standard of authentication provided that the agency shall monitor the impact of the higher standard on the right of consumers to obtain their personal information to ensure that the requirements of verification do not result in the unreasonable denial of verifiable consumer requests.

(14) Issuing regulations requiring businesses whose processing of consumers’ personal information presents significant risk to consumers’ privacy or security, to:

(A) Perform a cybersecurity audit on an annual basis, including defining the scope of the audit and establishing a process to ensure that audits are thorough and independent. The factors to be considered in determining when processing may result in significant risk to the security of personal information shall include the size and complexity of the business and the nature and scope of processing activities.

(B) Submit to the California Privacy Protection Agency on a regular basis a risk assessment with respect to their processing of personal information, including whether the processing involves sensitive personal information, and identifying and weighing the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, with the goal of restricting or prohibiting the processing if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public. Nothing in this section shall require a business to divulge trade secrets.

(15) Issuing regulations governing access and opt-out rights with respect to a business’ use of automated decisionmaking technology, including profiling and requiring a business’ response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer.

(16) Issuing regulations to further define a “law enforcement agency-approved investigation” for purposes of the exception in subparagraph (B) of paragraph (1) of subdivision (a) of Section 1798.145.

(17) Issuing regulations to define the scope and process for the exercise of the agency’s audit authority, to establish criteria for selection of persons to audit, and to protect consumers’ personal information from disclosure to an auditor in the absence of a court order, warrant, or subpoena.

(18) (A) Issuing regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumer’s intent to opt out of the sale or sharing of the consumer’s personal information and to limit the use or disclosure of the consumer’s sensitive personal information. The requirements and specifications for the opt-out preference signal should be updated from time to time to reflect the means by which consumers interact with businesses, and should:

(i) Ensure that the manufacturer of a platform or browser or device that sends the opt-out preference signal cannot unfairly disadvantage another business.

(ii) Ensure that the opt-out preference signal is consumer-friendly, clearly described, and easy to use by an average consumer and does not require that the consumer provide additional information beyond what is necessary.

(iii) Clearly represent a consumer’s intent and be free of defaults constraining or presupposing that intent.

(iv) Ensure that the opt-out preference signal does not conflict with other commonly used privacy settings or tools that consumers may employ.

(v) Provide a mechanism for the consumer to selectively consent to a business’ sale of the consumer’s personal information, or the use or disclosure of the consumer’s sensitive personal information, without affecting the consumer’s preferences with respect to other businesses or disabling the opt-out preference signal globally.

(vi) State that in the case of a page or setting view that the consumer accesses to set the opt-out preference signal, the consumer should see up to three choices, including:

(I) Global opt out from sale and sharing of personal information, including a direction to limit the use of sensitive personal information.

(II) Choice to “Limit the Use of My Sensitive Personal Information.”

(III) Choice titled “Do Not Sell/Do Not Share My Personal Information for Cross-Context Behavioral Advertising.”

(B) Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age.

(C) Issuing regulations, with the goal of strengthening consumer privacy while considering the legitimate operational interests of businesses, to govern the use or disclosure of a consumer’s sensitive personal information, notwithstanding the consumer’s direction to limit the use or disclosure of the consumer’s sensitive personal information, including:

(i) Determining any additional purposes for which a business may use or disclose a consumer’s sensitive personal information.

(ii) Determining the scope of activities permitted under paragraph (8) of subdivision (e) of Section 1798.140, as authorized by subdivision (a) of Section 1798.121, to ensure that the activities do not involve health-related research.

(iii) Ensuring the functionality of the business’ operations.

(iv) Ensuring that the exemption in subdivision (d) of Section 1798.121 for sensitive personal information applies to information that is collected or processed incidentally, or without the purpose of inferring characteristics about a consumer, while ensuring that businesses do not use the exemption for the purpose of evading consumers’ rights to limit the use and disclosure of their sensitive personal information under Section 1798.121.

(19) Issuing regulations to govern how a business that has elected to comply with subdivision (b) of Section 1798.135 responds to the opt-out preference signal and provides consumers with the opportunity subsequently to consent to the sale or sharing of their personal information or the use and disclosure of their sensitive personal information for purposes in addition to those authorized by subdivision (a) of Section 1798.121. The regulations should:

(A) Strive to promote competition and consumer choice and be technology neutral.

(B) Ensure that the business does not respond to an opt-out preference signal by:

(i) Intentionally degrading the functionality of the consumer experience.

(ii) Charging the consumer a fee in response to the consumer’s opt-out preferences.

(iii) Making any products or services not function properly or fully for the consumer, as compared to consumers who do not use the opt-out preference signal.

(iv) Attempting to coerce the consumer to opt in to the sale or sharing of the consumer’s personal information, or the use or disclosure of the consumer’s sensitive personal information, by stating or implying that the use of the opt-out preference signal will adversely affect the consumer as compared to consumers who do not use the opt-out preference signal, including stating or implying that the consumer will not be able to use the business’ products or services or that those products or services may not function properly or fully.

(v) Displaying any notification or popup in response to the consumer’s opt-out preference signal.

(C) Ensure that any link to a web page or its supporting content that allows the consumer to consent to opt in:

(i) Is not part of a popup, notice, banner, or other intrusive design that obscures any part of the web page the consumer intended to visit from full view or that interferes with or impedes in any way the consumer’s experience visiting or browsing the web page or internet website the consumer intended to visit.

(ii) Does not require or imply that the consumer must click the link to receive full functionality of any products or services, including the internet website.

(iii) Does not make use of any dark patterns.

(iv) Applies only to the business with which the consumer intends to interact.

(D) Strive to curb coercive or deceptive practices in response to an opt-out preference signal but should not unduly restrict businesses that are trying in good faith to comply with Section 1798.135.

(20) Review existing Insurance Code provisions and regulations relating to consumer privacy, except those relating to insurance rates or pricing, to determine whether any provisions of the Insurance Code provide greater protection to consumers than the provisions of this title. Upon completing its review, the agency shall adopt a regulation that applies only the more protective provisions of this title to insurance companies. For the purpose of clarity, the Insurance Commissioner shall have jurisdiction over insurance rates and pricing.

(21) Harmonizing the regulations governing opt-out mechanisms, notices to consumers, and other operational mechanisms in this title to promote clarity and the functionality of this title for consumers.

(b) The Attorney General may adopt additional regulations as necessary to further the purposes of this title.

(c) The Attorney General shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.

(d) Notwithstanding subdivision (a), the timeline for adopting final regulations required by the act adding this subdivision shall be July 1, 2022. Beginning the later of July 1, 2021, or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking under this title, the authority assigned to the Attorney General to adopt regulations under this section shall be exercised by the California Privacy Protection Agency. Notwithstanding any other law, civil and administrative enforcement of the provisions of law added or amended by this act shall not commence until July 1, 2023, and shall only apply to violations occurring on or after that date. Enforcement of provisions of law contained in the California Consumer Privacy Act of 2018 amended by this act shall remain in effect and shall be enforceable until the same provisions of this act become enforceable.

history: (History: Amended by Stats. 2025, Ch. 67, Sec. 28. (AB 1170) Effective January 1, 2026.)


text:
Anti-Avoidance

A court or the agency shall disregard the intermediate steps or transactions for purposes of effectuating the purposes of this title:

(a) If a series of steps or transactions were component parts of a single transaction intended from the beginning to be taken with the intention of avoiding the reach of this title, including the disclosure of information by a business to a third party in order to avoid the definition of sell or share.

(b) If steps or transactions were taken to purposely avoid the definition of sell or share by eliminating any monetary or other valuable consideration, including by entering into contracts that do not include an exchange for monetary or other valuable consideration, but where a party is obtaining something of value or use.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 22. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)


text:
Waiver

Any provision of a contract or agreement of any kind, including a representative action waiver, that purports to waive or limit in any way rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable. This section shall not prevent a consumer from declining to request information from a business, declining to opt out of a business’s sale of the consumer’s personal information, or authorizing a business to sell or share the consumer’s personal information after previously opting out.

history: (History: Amended November 3, 2020, by initiative Proposition 24, Sec. 23. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)


text: This title shall be liberally construed to effectuate its purposes.

history: (History: Added by Stats. 2018, Ch. 55, Sec. 3. (AB 375) Effective January 1, 2019. Section operative January 1, 2020, pursuant to Section 1798.198.)


text: This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is preempted by, or in conflict with, federal law or the United States or California Constitution.

history: (History: Amended (as added by Stats. 2018, Ch. 55, Sec. 3) by Stats. 2018, Ch. 735, Sec. 15. (SB 1121) Effective September 23, 2018. Section operative January 1, 2020, pursuant to Section 1798.198.)


text:
(a) Subject to limitation provided in subdivision (b), and in Section 1798.199, this title shall be operative January 1, 2020.

(b) This title shall become operative only if initiative measure No. 17-0039, The Consumer Right to Privacy Act of 2018, is withdrawn from the ballot pursuant to Section 9604 of the Elections Code.

history: (History: Amended (as added by Stats. 2018, Ch. 55, Sec. 3) by Stats. 2018, Ch. 735, Sec. 16. (SB 1121) Effective September 23, 2018.)


text: Notwithstanding Section 1798.198, Section 1798.180 shall be operative on the effective date of the act adding this section.

history: (History: Added by Stats. 2018, Ch. 735, Sec. 17. (SB 1121) Effective September 23, 2018. Operative September 23, 2018.)


text:
(a) There is hereby established in state government the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018. The agency shall be governed by a five-member board, including the chairperson. The chairperson and one member of the board shall be appointed by the Governor. The Attorney General, Senate Rules Committee, and Speaker of the Assembly shall each appoint one member. These appointments should be made from among Californians with expertise in the areas of privacy, technology, and consumer rights.

(b) The initial appointments to the agency shall be made within 90 days of the effective date of the act adding this section.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.1. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
Members of the agency board shall:

(a) Have qualifications, experience, and skills, in particular in the areas of privacy and technology, required to perform the duties of the agency and exercise its powers.

(b) Maintain the confidentiality of information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure is required by the Public Records Act.

(c) Remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from another.

(d) Refrain from any action incompatible with their duties and engaging in any incompatible occupation, whether gainful or not, during their term.

(e) Have the right of access to all information made available by the agency to the chairperson.

(f) Be precluded, for a period of one year after leaving office, from accepting employment with a business that was subject to an enforcement action or civil action under this title during the member’s tenure or during the five-year period preceding the member’s appointment.

(g) Be precluded for a period of two years after leaving office from acting, for compensation, as an agent or attorney for, or otherwise representing, any other person in a matter pending before the agency if the purpose is to influence an action of the agency.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.2. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text: Members of the agency board, including the chairperson, shall serve at the pleasure of their appointing authority but shall serve for no longer than eight consecutive years.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.3. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text: For each day on which they engage in official duties, members of the agency board shall be compensated at the rate of one hundred dollars ($100), adjusted pursuant to subdivision (d) of Section 1798.199.95, and shall be reimbursed for expenses incurred in performance of their official duties.

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 10. (AB 3286) Effective January 1, 2025.)


text: The agency board shall appoint an executive director who shall act in accordance with agency policies and regulations and with applicable law. The agency shall appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and shall fix the compensation of employees and prescribe their duties. The agency may contract for services that cannot be provided by its employees.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.5. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text: The agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.6. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
The agency shall perform the following functions:

(a) Administer, implement, and enforce through administrative actions this title.

(b) On and after the later of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185 to carry out the purposes and provisions of the California Consumer Privacy Act of 2018, including regulations specifying recordkeeping requirements for businesses to ensure compliance with this title.

(c) Through the implementation of this title, protect the fundamental privacy rights of natural persons with respect to the use of their personal information.

(d) Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale, and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the agency pursuant to paragraph (14) of subdivision (a) of Section 1798.185 while ensuring that data security is not compromised.

(e) Provide guidance to consumers regarding their rights under this title.

(f) Provide guidance to businesses regarding their duties and responsibilities under this title and appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance with this title pursuant to regulations adopted pursuant to paragraph (17) of subdivision (a) of Section 1798.185.

(g) Provide technical assistance and advice to the Legislature, upon request, with respect to privacy-related legislation.

(h) Monitor relevant developments relating to the protection of personal information and, in particular, the development of information and communication technologies and commercial practices.

(i) Cooperate with other agencies with jurisdiction over privacy laws and with data processing authorities in California, other states, territories, and countries to ensure consistent application of privacy protections.

(j) Establish a mechanism pursuant to which persons doing business in California that do not meet the definition of business set forth in paragraph (1), (2), or (3) of subdivision (d) of Section 1798.140 may voluntarily certify that they are in compliance with this title, as set forth in paragraph (4) of subdivision (d) of Section 1798.140, and make a list of those entities available to the public.

(k) Solicit, review, and approve applications for grants to the extent funds are available pursuant to paragraph (2) of subdivision (b) of Section 1798.160.

(l) Perform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdiction and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 11. (AB 3286) Effective January 1, 2025.)


text:
(a) Upon the sworn complaint of any person or on its own initiative, the agency may investigate possible violations of this title relating to any business, service provider, contractor, or person. The agency may decide not to investigate a complaint or decide to provide a business with a time period to cure the alleged violation. In making a decision not to investigate or provide more time to cure, the agency may consider the following:

(1) Lack of intent to violate this title.

(2) Voluntary efforts undertaken by the business, service provider, contractor, or person to cure the alleged violation prior to being notified by the agency of the complaint.

(b) (1) The agency shall notify in writing the person who made the complaint of the action, if any, the agency has taken or plans to take on the complaint, together with the reasons for that action or nonaction.

(2) The written notification required by this subdivision shall not include information that is subject to law enforcement exemptions and privileges, including, but not limited to, confidential information related to an investigation and information that is privileged under the Evidence Code and the Government Code.

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 12. (AB 3286) Effective January 1, 2025.)


text: No finding of probable cause to believe this title has been violated shall be made by the agency unless, at least 30 days prior to the agency’s consideration of the alleged violation, the business, service provider, contractor, or person alleged to have violated this title is notified of the violation by service of process or registered mail with return receipt requested, provided with a summary of the evidence, and informed of their right to be present in person and represented by counsel at any proceeding of the agency held for the purpose of considering whether probable cause exists for believing the person violated this title. Notice to the alleged violator shall be deemed made on the date of service, the date the registered mail receipt is signed, or if the registered mail receipt is not signed, the date returned by the post office. A proceeding held for the purpose of considering probable cause shall be private unless the alleged violator files with the agency a written request that the proceeding be public.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.9. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
(a) When the agency determines there is probable cause for believing this title has been violated, it shall hold a hearing to determine if a violation has or violations have occurred. Notice shall be given and the hearing conducted in accordance with the Administrative Procedure Act (Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code). The agency shall have all the powers granted by that chapter. If the agency determines on the basis of the hearing conducted pursuant to this subdivision that a violation or violations have occurred, it shall issue an order that may require the violator to do all or any of the following:

(1) Cease and desist violation of this title.

(2) Subject to Section 1798.155, pay an administrative fine of up to two thousand five hundred dollars ($2,500) for each violation, or up to seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers. When the agency determines that no violation has occurred, it shall publish a declaration so stating.

(A) Ninety-five percent of any administrative fine assessed pursuant to this paragraph shall be deposited into the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b) of Section 1798.160.

(B) Five percent of any administrative fine assessed pursuant to this paragraph shall be deposited into the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.

(b) If two or more persons are responsible for any violation or violations, they shall be jointly and severally liable.

history: (History: Amended by Stats. 2025, Ch. 20, Sec. 3. (AB 137) Effective June 30, 2025.)


text: Whenever the agency rejects the decision of an administrative law judge made pursuant to Section 11517 of the Government Code, the agency shall state the reasons in writing for rejecting the decision.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.11. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text: The agency may subpoena witnesses, compel their attendance and testimony, administer oaths and affirmations, take evidence and require by subpoena the production of any books, papers, records, or other items material to the performance of the agency’s duties or exercise of its powers, including, but not limited to, its power to audit a business’ compliance with this title.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.12. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.

(a) The service of the probable cause hearing notice, as required by Section 1798.199.50, upon the person alleged to have violated this title shall constitute the commencement of the administrative action.

(b) If the person alleged to have violated this title engages in the fraudulent concealment of the person’s acts or identity, the five-year period shall be tolled for the period of the concealment. For purposes of this subdivision, “fraudulent concealment” means the person knows of material facts related to the person’s duties under this title and knowingly conceals them in performing or omitting to perform those duties for the purpose of defrauding the public of information to which it is entitled under this title.

(c) If, upon being ordered by a superior court to produce any documents sought by a subpoena in any administrative proceeding under this title, the person alleged to have violated this title fails to produce documents in response to the order by the date ordered to comply therewith, the five-year period shall be tolled for the period of the delay from the date of filing of the motion to compel until the date the documents are produced.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.13. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
(a) In addition to any other available remedies, the agency may bring a civil action and obtain a judgment in superior court for the purpose of collecting any unpaid administrative fines imposed pursuant to this title after exhaustion of judicial review of the agency’s action. The action may be filed as a small claims, limited civil, or unlimited civil case depending on the jurisdictional amount. The venue for this action shall be in the county where the administrative fines were imposed by the agency. In order to obtain a judgment in a proceeding under this section, the agency shall show, following the procedures and rules of evidence as applied in ordinary civil actions, all of the following:

(1) That the administrative fines were imposed following the procedures set forth in this title and implementing regulations.

(2) That the defendant or defendants in the action were notified, by actual or constructive notice, of the imposition of the administrative fines.

(3) That a demand for payment has been made by the agency and full payment has not been received.

(b) A civil action brought pursuant to subdivision (a) shall be commenced within four years after the date on which the administrative fines were imposed.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.14. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
(a) If the time for judicial review of a final agency order or decision has lapsed, or if all means of judicial review of the order or decision have been exhausted, the agency may apply to the clerk of the court for a judgment to collect the administrative fines imposed by the order or decision, or the order as modified in accordance with a decision on judicial review.

(b) The application, which shall include a certified copy of the order or decision, or the order as modified in accordance with a decision on judicial review, and proof of service of the order or decision, constitutes a sufficient showing to warrant issuance of the judgment to collect the administrative fines. The clerk of the court shall enter the judgment immediately in conformity with the application.

(c) An application made pursuant to this section shall be made to the clerk of the superior court in the county where the administrative fines were imposed by the agency.

(d) A judgment entered in accordance with this section has the same force and effect as, and is subject to all the provisions of law relating to, a judgment in a civil action and may be enforced in the same manner as any other judgment of the court in which it is entered.

(e) The agency may bring an application pursuant to this section only within four years after the date on which all means of judicial review of the order or decision have been exhausted.

(f) The remedy available under this section is in addition to those available under any other law.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.15. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text: Any decision of the agency with respect to a complaint or administrative fine shall be subject to judicial review in an action brought by an interested party to the complaint or administrative fine and shall be subject to an abuse of discretion standard.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.16. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
(a) Any business, service provider, contractor, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers, as adjusted pursuant to subdivision (d) of Section 1798.199.95, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty.

(b) (1) (A) Ninety-five percent of any civil penalty recovered by an action brought by the Attorney General for a violation of this title, and of the proceeds of any settlement of those actions, shall be deposited into the Attorney General Consumer Privacy Enforcement Subfund created within the Consumer Privacy Fund pursuant to subdivision (c) of Section 1798.160 to support the Attorney General in the enforcement of this title.

(B) Notwithstanding any provision to the contrary, the Attorney General may, if an action or settlement is the result of a joint investigation with the agency, deposit a portion of the penalties and proceeds that would otherwise be subject to subparagraph (A) into the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b) of Section 1798.160 in the amount necessary to provide reimbursement for investigative costs.

(2) Five percent of any civil penalty recovered by an action brought by the Attorney General for a violation of this title, and of the proceeds of any settlement of those actions, shall be deposited into the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.

(c) The agency shall, upon request by the Attorney General, stay an administrative action or investigation under this title to permit the Attorney General to proceed with an investigation or civil action and shall not pursue an administrative action or investigation, unless the Attorney General subsequently determines not to pursue an investigation or civil action. The agency may not limit the authority of the Attorney General to enforce this title.

(d) No civil action may be filed by the Attorney General under this section for any violation of this title after the agency has issued a decision pursuant to Section 1798.199.85 or an order pursuant to Section 1798.199.55 against that person for the same violation.

(e) This section shall not affect the private right of action provided for in Section 1798.150.

history: (History: Amended by Stats. 2025, Ch. 20, Sec. 4. (AB 137) Effective June 30, 2025.)


text:
(a) There is hereby appropriated from the General Fund of the state to the agency the sum of five million dollars ($5,000,000) during the fiscal year 2020–21, and the sum of ten million dollars ($10,000,000) adjusted for cost-of-living changes, during each fiscal year thereafter, for expenditure to support the operations of the agency pursuant to this title. The expenditure of funds under this appropriation shall be subject to the normal administrative review given to other state appropriations. The Legislature shall appropriate those additional amounts to the commission and other agencies as may be necessary to carry out the provisions of this title.

(b) The Department of Finance, in preparing the state budget and the Budget Act bill submitted to the Legislature, shall include an item for the support of this title that shall indicate all of the following:

(1) The amounts to be appropriated to other agencies to carry out their duties under this title, which amounts shall be in augmentation of the support items of those agencies.

(2) The additional amounts required to be appropriated by the Legislature to the agency to carry out the purposes of this title, as provided for in this section.

(3) In parentheses, for informational purposes, the continuing appropriation during each fiscal year of ten million dollars ($10,000,000), adjusted for cost-of-living changes made pursuant to this section.

(c) The Attorney General shall provide staff support to the agency until the agency has hired its own staff. The Attorney General shall be reimbursed by the agency for these services.

(d) (1) On January 1, 2025, and on January 1 of any odd-numbered year thereafter, the California Privacy Protection Agency shall adjust the monetary thresholds in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140, subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150, subdivision (a) of Section 1798.155, Section 1798.199.25, and subdivision (a) of Section 1798.199.90 to reflect any increase in the Consumer Price Index.

(2) The agency shall use the Consumer Price Index (CPI) - California, All Items, All Urban Consumers percentage change from the previous two years’ reports, published by the Department of Industrial Relations, Office of the Director–Research. The agency shall apply the percentage change in the CPI for the August-to-August point in time of the prior two years. The increase in the thresholds shall be rounded to the nearest whole dollar.

(3) The agency shall post the adjusted monetary thresholds on its internet website no later than January 15 of the year in which the adjustment becomes effective.

(4) Notwithstanding any other law, adjustments to monetary thresholds and their publication on the agency’s internet website pursuant to this subdivision are not subject to the rulemaking provisions of the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code).

history: (History: Amended by Stats. 2024, Ch. 121, Sec. 14. (AB 3286) Effective January 1, 2025.)


text: The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation.

history: (History: Added November 3, 2020, by initiative Proposition 24, Sec. 24.19. Effective December 16, 2020. Operative December 16, 2020, pursuant to Sec. 31 of Proposition 24.)


text:
For purposes of this title, the following terms are defined as follows:

(a) “Business entity filing” means a document required by law to be filed with the Secretary of State pursuant to the Corporations Code, the Financial Code, or the Insurance Code.

(b) “Personal identifying information” has the same meaning as defined in subdivision (b) of Section 530.55 of the Penal Code.

(c) “Person” means a natural person, firm, association, organization, partnership, business trust, company, corporation, limited liability company, or public entity.

history: (History: Added by Stats. 2018, Ch. 696, Sec. 1. (SB 1196) Effective January 1, 2019.)

title: 1.81.6. Identity Theft in Business Entity Filings


text:
A person who has learned or reasonably suspects that his or her personal identifying information has been used unlawfully, as described in subdivision (a) of Section 530.5 of the Penal Code, in a business entity filing, and has initiated a law enforcement investigation in accordance with subdivision (a) of Section 530.6 of the Penal Code, may petition the superior court in the county in which the person resides for an order, which may be granted ex parte, directing the alleged perpetrator of the act described in paragraph (1) of subdivision (c) of Section 530.5 of the Penal Code, if known, and the person using the personal identifying information in the business entity filing to appear at a hearing before the court and show cause for both of the following:

(a) Why the personal identifying information should not be labeled to show the information is impersonated and does not reflect the person’s identity.

(b) Why the personal identifying information should be associated with the business entity.

path: 1.81.6. Identity Theft in Business Entity Filings


text:
(a) A petition filed pursuant to Section 1798.201 shall be heard and determined based on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made part of the record by the court.

(b) If the court determines the petition is meritorious and there is no reasonable cause to believe that the victim’s personal identifying information has been used lawfully in the business entity filing, the court shall make a finding that the victim’s personal identifying information has been used unlawfully in the business entity filing and shall issue an order certifying this determination.

(c) Upon making a determination pursuant to subdivision (b), the court shall do the following:

(1) Order the name and associated personal identifying information in the business entity filing to be redacted or labeled to show that the data is impersonated and does not reflect the victim’s identity.

(2) Order the data to be removed from publicly accessible electronic indexes and databases.

(d) A determination made pursuant to subdivision (b) may be vacated at any time if the petition or any information submitted in support of the petition is found to contain any material misrepresentation or was obtained by fraud.

(e) The Judicial Council shall develop a form for issuing an order of determination pursuant to this section.

(f) An order issued pursuant to subdivision (c) shall be filed with the Secretary of State.

(g) If an order has been filed pursuant to subdivision (f) within the record of a limited liability company or a corporation, the Secretary of State may cancel the business entity that is the subject of the order if, after 60 days, an updated statement of information has not been filed on behalf of the entity with the Secretary of State. The statement of information shall not contain any information ordered to be redacted pursuant to subdivision (c).

history: (History: Amended by Stats. 2024, Ch. 783, Sec. 1. (SB 1168) Effective January 1, 2025.)


text:
(a) In addition to any of the other remedies provided under this title, a person who has learned that their personal identifying information has been used unlawfully, as described in subdivision (a) of Section 530.5 of the Penal Code, in a business entity filing may file with the Secretary of State a disclaimer of proper authority, as described in subdivision (b) and on a form prescribed by the Secretary of State, so long as the business entity has not been dissolved or terminated at the time of filing the disclaimer.

(b) A disclaimer of proper authority shall be signed and verified under penalty of perjury by the person claiming their personal identifying information was unlawfully used in the business entity filing as described in subdivision (a) and shall contain all of the following information:

(1) The name of the corporation, limited liability company, or limited partnership as it appears on the records of the Secretary of State.

(2) The Secretary of State file number for the corporation, limited liability company, or limited partnership.

(3) The entity type.

(4) The date the business entity document containing their personal identifying information was filed.

(5) The title of the business entity document that contained their personal identifying information.

(6) A description of the type of personal identifying information that the person claims was used unlawfully in the business entity filing.

(7) A statement that the person signing the disclaimer of proper authority did not authorize the use of their personal identifying information within the business entity document and that they reasonably suspect that their personal identifying information was included in furtherance of an unlawful purpose, as described in subdivision (a) of Section 530.5 of the Penal Code.

(8) A statement that the disclaimer of proper authority does not constitute a determination of any court or law enforcement investigation surrounding the facts and circumstances of the use of the information within the business entity document.

(c) The fee for filing a disclaimer of proper authority pursuant to this section shall be thirty dollars ($30) to cover the reasonable costs to the Secretary of State of processing that form.

history: (History: Added by Stats. 2024, Ch. 783, Sec. 2. (SB 1168) Effective January 1, 2025.)


text:
As used in this title, the following definitions apply:

(a) “Abusive litigation” means litigation or other legal action to deter, prevent, sanction, or punish a person engaging in legally protected health care activity by either of the following:

(1) Filing or prosecuting an action in a state other than California where liability, in whole or part, directly or indirectly, is based on a legally protected health care activity that was legal in the state in which it occurred, including an action in which liability is based on a theory of vicarious, joint, or several liability.

(2) Attempting to enforce an order or judgment issued in connection with an action described in paragraph (1) by a party to that action or a person acting on behalf of a party to that action. An action shall be considered to be based on conduct that was legal in the state in which it occurred if a part of an act or omission involved in the course of conduct that forms the basis for liability in the action occurs or is initiated in a state in which the health care was legal, whether or not the act or omission is alleged or included in a pleading or other filing in the lawsuit.

(b) “Aggrieved person, provider, or other entity” includes, but is not limited to, a person who resides in California, a business or entity doing business in the state or located in the state, a health care service plan, a health insurer, a person or entity that provided a legally protected health care activity in California, a person who received a legally protected health care activity from a provider licensed in California, a person or entity that is licensed in California to provide a legally protected health care activity, including a provider, clinic, or a person who assisted a person or entity that received or provided a legally protected health care activity in California.

(c) “Gender-affirming health care services” and “gender-affirming mental health care services” have the same meaning as defined in paragraph (3) of subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.

(d) (1) “Legally protected health care activity” means any of the following:

(A) The exercise and enjoyment, or attempted exercise and enjoyment, by a person of rights to reproductive health care services, gender-affirming health care services, or gender-affirming mental health care services secured by the Constitution or laws of California or the provision by a health care service plan contract or a policy, or a certificate of health insurance, that provides for such services.

(B) An act or omission undertaken to aid or encourage, or attempt to aid or encourage, a person in the exercise and enjoyment or attempted exercise and enjoyment of rights to reproductive health care services, gender-affirming health care services, or gender-affirming mental health care services secured by the Constitution or laws of California.

(C) The provision of reproductive health care services, gender-affirming health care services, or gender-affirming mental health care services by a person duly licensed under the laws of California or the coverage of, and reimbursement for, such services or care by a health care service plan or a health insurer, if the service or care is lawful under the laws of California, regardless of the patient’s location.

(2) “Legally protected health care activity” does not include any activity that would be deemed unprofessional conduct or that would violate antidiscrimination laws of California.

(e) “Reproductive health care services” means and includes all services, care, or products of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, prescribing, or dispensing nature relating to the human reproductive system provided in accordance with the constitution and laws of this state, whether provided in person or by means of telehealth services which includes, but is not limited to, all services, care, and products relating to pregnancy, the termination of a pregnancy, assisted reproduction, or contraception.

history: (History: Added by Stats. 2023, Ch. 260, Sec. 6. (SB 345) Effective January 1, 2024.)

title: 1.81.7. Reproductive and Gender-Affirming Health Care Services


text: Reproductive health care services, gender-affirming health care services, and gender-affirming mental health care services are rights secured by the Constitution and laws of California. Interference with these rights, whether or not under the color of law, is against the public policy of California.

path: 1.81.7. Reproductive and Gender-Affirming Health Care Services


text: A public act or record of a foreign jurisdiction that prohibits, criminalizes, sanctions, authorizes a person to bring a civil action against, or otherwise interferes with a person, provider, or other entity in California that seeks, receives, causes, aids in access to, aids, abets, provides, or attempts or intends to seek, receive, cause, aid in access to, aid, abet, or provide, reproductive health care services, gender-affirming health care services, or gender-affirming mental health care services shall be an interference with the exercise and enjoyment of the rights secured by the Constitution and laws of California and shall be a violation of the public policy of California.


text: If a person, whether or not acting under color of law, engages or attempts to engage in abusive litigation that infringes on or interferes with, or attempts to infringe on or interfere with, a legally protected health care activity, then an aggrieved person, provider, carrier, or other entity, including a defendant in the abusive litigation, may institute a civil action for injunctive, monetary, or other appropriate relief within three years after the cause of action accrues.


text: An aggrieved person, provider, or other entity, including a defendant in abusive litigation, may move to modify or quash a subpoena issued in connection with abusive litigation on the grounds that the subpoena is unreasonable, oppressive, or inconsistent with the public policy of California.


text: If the court finds for the petitioner in an action authorized by Section 1798.303, recovery shall be in the amount of three times the amount of actual damages, which shall include damages for the amount of a judgment issued in connection with an abusive litigation, and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the abusive litigation.


text:
(a) A court may exercise jurisdiction over a person in an action authorized by Section 1798.303 if any of the following apply:

(1) Personal jurisdiction is found under Section 410.10 of the Code of Civil Procedure.

(2) The person has commenced an action in a court in California and, during the pendency of that action or an appeal therefrom, a summons and complaint is served on the person or the attorney appearing on the person’s behalf in that action or as otherwise permitted by law.

(3) The exercise of jurisdiction is permitted under the Constitution of the United States.

(b) This section does not apply to a lawsuit or judgment entered in another state that is based on conduct for which a cause of action exists under the laws of California, including a contract, tort, common law, or statutory claim.


text: Notwithstanding any other law, the laws of California shall govern in a case or controversy heard in California related to reproductive health care services, gender-affirming health care services, or gender-affirming mental health care services, except as may be required by federal law.


text: This title shall not be construed to provide jurisdiction over a California resident in an out-of-state forum when the California resident has not availed themselves of that forum.


text:
For the purposes of this title:

(a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state.

(2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.

(b) “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the purpose of sharing with developers of applications that indicates the user’s age range, including, at a minimum, the following:

(1) Whether a user is under 13 years of age.

(2) Whether the user is at least 13 years of age and under 16 years of age.

(3) Whether the user is at least 16 years of age and under 18 years of age.

(4) Whether the user is at least 18 years of age.

(c) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.

(d) “Child” means a natural person who is under 18 years of age.

(e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.

(2) “Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.

(f) “Developer” means a person that owns, maintains, or controls an application.

(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.

(h) “Signal” means age bracket data sent by a real-time secure application programming interface or operating system to an application.

(i) “User” means a child that is the primary user of the device.

history: (History: Added by Stats. 2025, Ch. 675, Sec. 1. (AB 1043) Effective January 1, 2026. Operative January 1, 2027, pursuant to Section 1798.505.)

title: 1.81.9. Digital Age Assurance Act

path: 1.81.9. Digital Age Assurance Act


text:
(a) An operating system provider shall do all of the following:

(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.

(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

(A) Under 13 years of age.

(B) At least 13 years of age and under 16 years of age.

(C) At least 16 years of age and under 18 years of age.

(D) At least 18 years of age.

(3) Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.

(b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

(2) (A) A developer that receives a signal pursuant to this title shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.

(B) A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.

(3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.

(B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.

(4) A developer that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either of the following:

(A) Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.

(B) Share the signal with a third party for a purpose not required by this title.

title: 1.81.9. Digital Age Assurance Act


text:
(a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.

(b) If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and the developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store with respect to that user before July 1, 2027.

title: 1.81.9. Digital Age Assurance Act


text:
(a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.

(b) An operating system provider or a covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer that receives a signal indicating a user’s age range.

title: 1.81.9. Digital Age Assurance Act


text:
(a) This title does not modify, impair, or supersede the operation of any antitrust law.

(b) This title does not require the collection of additional personal information from device owners or device users other than that which is necessary to comply with Section 1798.501.

(c) An operating system provider or a covered application store shall comply with this title in a nondiscriminatory manner, including, but not limited to, by complying with both of the following:

(1) An operating system provider or a covered application store shall impose at least the same restrictions and obligations on its own applications and application distribution as it does on those from third-party applications or application distributors.

(2) An operating system provider or a covered application store shall not use data collected from a third party in the course of compliance with this title to compete against that third party, give the covered application store’s services preference relative to those of a third party, or to otherwise use this data or consent mechanism in an anticompetitive manner.

(d) The protections provided by this title are in addition to those provided by any other applicable law, including, but not limited to, the California Age-Appropriate Design Code Act (Title 1.81.47 (commencing with Section 1798.99.28)).

(e) If any provision of this title, or application thereof, to any person or circumstance is held invalid, that invalidity shall not affect other provisions or applications of this title that can be given effect without the invalid provision or application, and to this end the provisions of this title are declared to be severable.

(f) This title does not apply to any of the following:

(1) A broadband internet access service, as defined in Section 3100.

(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.

(3) The delivery or use of a physical product.

(g) This title does not impose liability on an operating system provider, a covered application store, or a developer that arises from the use of a device or application by a person who is not the user to whom a signal pertains.

title: 1.81.9. Digital Age Assurance Act


text: This title shall become operative on January 1, 2027.

history: (History: Added by Stats. 2025, Ch. 675, Sec. 1. (AB 1043) Effective January 1, 2026.)

title: 1.81.9. Digital Age Assurance Act


text:
For purposes of this title, the following definitions shall apply:

(a) “Contactless identification document system” means a group of identification documents issued and operated under a single authority that use RFID to transmit data remotely to readers intended to read that data. In a contactless identification document system, every reader must be able to read every identification document in the system.

(b) “Data” means any information stored or transmitted on an identification document in machine-readable form.

(c) “Identification document” means any document containing data that is issued to an individual and which that individual, and only that individual, uses alone or in conjunction with any other information for the primary purpose of establishing his or her identity. Identification documents specifically include, but are not limited to, the following:

(1) Driver’s licenses or identification cards issued pursuant to Section 13000 of the Vehicle Code.

(2) Identification cards for employees or contractors.

(3) Identification cards issued by educational institutions.

(4) Health insurance or benefit cards.

(5) Benefit cards issued in conjunction with any government-supported aid program.

(6) Licenses, certificates, registration, or other means to engage in a business or profession regulated by the Business and Professions Code.

(7) Library cards issued by any public library.

(d) “Key” means a string of bits of information used as part of a cryptographic algorithm used in encryption.

(e) “Radio frequency identification” or “RFID” means the use of electromagnetic radiating waves or reactive field coupling in the radio frequency portion of the spectrum to communicate to or from an identification document through a variety of modulation and encoding schemes.

(f) “Reader” means a scanning device that is capable of using RFID to communicate with an identification document and read the data transmitted by that identification document.

(g) “Remotely” means that no physical contact between the identification document and a reader is necessary in order to transmit data using RFID.

history: (History: Added by Stats. 2008, Ch. 746, Sec. 2. Effective January 1, 2009.)

title: 1.80. Identification Documents

path: 1.80. Identification Documents


citation: CIV § 1799

text:
As used in this title:

(a) The term “bookkeeping services” means keeping books, making trial balances, preparing statements, making audits, or preparing reports, all as a part of bookkeeping operations, provided that such trial balances, statements, or reports are not issued over the name of such person as having been prepared or examined by a certified public accountant or public accountant.

(b) The term “business entity” means a sole proprietorship, partnership, corporation, association or other group, however organized and whether or not organized to operate at a profit, but does not mean a financial institution organized, chartered, or holding a license or authorization certificate under a law of this state or the United States to make loans or extend credit and subject to supervision by an official or agency of this state or the United States, nor the parent of any such financial institution, nor any subsidiary of any such financial institution or parent.

(c) The term “individual” means a natural person.

(d) The term “person” means any natural person, corporation, partnership, limited liability company, firm, association, or governmental entity.

(e) The term “record” means any item, collection, or grouping of information about an individual or business entity.

history: (History: Amended by Stats. 1994, Ch. 1010, Sec. 41. Effective January 1, 1995.)

title: 1.82. BUSINESS RECORDS

chapter: 1. Definitions

path: 1.82. BUSINESS RECORDS > 1. Definitions


text:
(a) No business entity which performs bookkeeping services shall disclose in whole or in part the contents of any record, including the disclosure of information in the record in any composite of information, which is prepared or maintained by such business entity to any person, other than the individual or business entity which is the subject of the record, without the express written consent of such individual or business entity.

(b) This section shall not apply to the following:

(1) To a disclosure to any person pursuant to a subpoena or court order.

(2) To a disclosure which is discoverable.

(3) To a disclosure to any person acting pursuant to a lawful search warrant.

(4) To a disclosure to a law enforcement agency when required for investigations of criminal activity, unless such disclosure is prohibited by law.

(5) To a disclosure to a taxing agency for purposes of tax administration.

history: (History: Added by Stats. 1977, Ch. 221.)

title: 1.82. BUSINESS RECORDS

chapter: 2. Disclosures

path: 1.82. BUSINESS RECORDS > 2. Disclosures


text:
(a) No person, including an individual, firm, corporation, association, partnership, or joint venture, or any employee or agent thereof, shall disclose information obtained from a federal or state income tax return or any information obtained from a tax schedule submitted with the return by a consumer in connection with a financial or other business-related transaction unless the disclosure is within any of the following:

(1) Consented to in writing by the consumer in a separate document that states to whom the disclosure will be made and how the information will be used. If the consumer agrees, this separate consent document may be in the form of an electronic record, executed by an electronic signature as provided by Title 2.5 (commencing with Section 1633.1) of Part 2 of Division 3 of the Civil Code.

(2) Authorized or required by state or federal law.

(3) Necessary to complete or service the financial or business-related transaction or to effect, administer, or enforce a financial or business-related transaction requested by the consumer.

(4) Pursuant to court order.

(5) Required to complete any of the transactions described in subparagraphs (A) to (D), inclusive, by a person, including an individual, firm, corporation, association, partnership or joint venture, if the disclosure is made solely for that purpose. The provisions of this section apply to any person, including an individual, firm, corporation, association, partnership, or joint venture, and any employee or agent thereof, receiving information as a result of a disclosure authorized by this paragraph.

(A) A proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit.

(B) A proposed or actual securitization or secondary market sale, including the sale of servicing rights.

(C) To provide information to insurance rate advisory organizations, guaranty funds or agencies, rating agencies, and other persons assessing compliance with industry standards.

(D) To protect against or to prevent actual or potential fraud and unauthorized transactions and claims and for institutional risk control activities.

(b) No unrelated use shall be made of a federal or state tax return or any information obtained therefrom or any information submitted with the return by a consumer in connection with a financial or other business-related transaction. “Unrelated use” means any use that is not necessary to effect, administer, or enforce the financial or other business-related transaction with the consumer or that is beyond the scope of the stated purpose to which the consumer consented for the use of the return or any other information he or she submitted.

(c) (1) For purposes of this section, the following definitions shall apply:

(A) “Affiliate” means any entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, another entity.

(B) “Consumer” means an individual who requests or obtains financial or other business-related services.

(C) “Tax return” means a return, declaration, statement, refund claim, or other document required to be made or to be filed in connection with state or federal income taxes or state bank and corporation franchise taxes.

(2) A disclosure prohibited by this section includes a disclosure made internally within the entity or by that entity to any of its subsidiaries or affiliates.

(3) The information described in subdivision (a) includes that information obtained through an electronic medium.

(d) No person, including an individual, firm, corporation, association, partnership, or joint venture, or any employee or agent thereof, shall dispose of any of the information described in subdivision (a) in a manner in which the identity of the consumer may be determined from the disposed information alone or in combination with other publicly available information. This subdivision shall not become operative if Assembly Bill 2246 of the 1999–2000 Regular Session is enacted and becomes effective on or before January 1, 2001.

(e) The civil remedies in Chapter 3 (commencing with Section 1799.2) shall be applicable to a violation of this section. Each violation of this section shall constitute a separate cause of action for which damages are recoverable.

(f) The treatment of tax returns by tax preparers, as defined in Section 22251 of the Business and Professions Code, shall be governed by Section 17530.5 of the Business and Professions Code.

history: (History: Added by Stats. 2000, Ch. 1084, Sec. 5. Effective January 1, 2001. Note: Subd. (d) is inoperative; AB 2246 was enacted as Ch. 1039, Stats. 2000.)

title: 1.82. BUSINESS RECORDS


text:
(a) Any credit card issuer that receives a change of address request, other than for a correction of a typographical error, from a cardholder who orders a replacement credit card within 60 days before or after that request is received shall send to that cardholder a change of address notification that is addressed to the cardholder at the cardholder’s previous address of record. If the replacement credit card is requested prior to the effective date of the change of address, the notification shall be sent within 30 days of the change of address request. If the replacement credit card is requested after the effective date of the change of address, the notification shall be sent within 30 days of the request for the replacement credit card.

(b) Any business entity that provides telephone accounts that receives a change of address request, other than for a correction of a typographical error, from an accountholder who orders new service, shall send to that accountholder a change of address notification that is addressed to the accountholder at the accountholder’s previous address of record. The notification shall be sent within 30 days of the request for new service.

(c) The notice required pursuant to subdivision (a) or (b) may be given by telephone or e-mail communication if the credit card issuer or business entity that provides telephone accounts reasonably believes that it has the current telephone number or e-mail address for the accountholder or cardholder who has requested a change of address. If the notification is in writing it may not contain the consumer’s account number, social security number, or other personal identifying information, but may contain the consumer’s name, previous address, and new address of record. For business entities described in subdivision (b), the notification may also contain the accountholder’s telephone number.

(d) A credit card issuer or a business entity that provides telephone accounts is not required to send a change of address notification when a change of address request is made in person by a consumer who has presented valid identification, or is made by telephone and the requester has provided a unique alpha-numeric password.

(e) The following definitions shall apply to this section:

(1) “Credit account” has the same meaning as “credit card,” as defined in subdivision (a) of Section 1747.02.

(2) “Telephone account” means an account with a telephone corporation, as defined in Section 234 of the Public Utilities Code.

history: (History: Amended by Stats. 2004, Ch. 183, Sec. 36. Effective January 1, 2005.)

title: 1.82. BUSINESS RECORDS


text:
(a) A person may initiate a civil action against a business entity in accordance with state law whenever a business entity violates the provisions of Section 1799.1.

(b) In any suit brought pursuant to the provisions of subdivision (a) a business entity which has violated Section 1799.1 shall be liable to the person in an amount equal to the actual damages sustained by the person as a result of such violation, but in no case less than five hundred dollars ($500), and the attendant court costs and reasonable attorneys’ fees.

(c) An action to enforce any liability created under this section may be brought in any court of competent jurisdiction within two years from the date on which the cause of action arose.

title: 1.82. BUSINESS RECORDS

chapter: 3. Civil Remedies

path: 1.82. BUSINESS RECORDS > 3. Civil Remedies


text:
(a) No person providing video recording sales or rental services shall disclose any personal information or the contents of any record, including sales or rental information, which is prepared or maintained by that person, to any person, other than the individual who is the subject of the record, without the written consent of that individual.

(b) This section does not apply to any of the following:

(1) To a disclosure to any person pursuant to a subpoena or court order.

(2) To a disclosure that is in response to the proper use of discovery in a pending civil action.

(3) To a disclosure to any person acting pursuant to a lawful search warrant.

(4) To a disclosure to a law enforcement agency when required for investigations of criminal activity, unless that disclosure is prohibited by law.

(5) To a disclosure to a taxing agency for purposes of tax administration.

(6) To a disclosure of names and addresses only for commercial purposes.

(c) Any willful violation of this section shall be subject to a civil penalty not to exceed five hundred dollars ($500) for each violation, which may be recovered in a civil action brought by the person who is the subject of the records.

(d) (1) Any person who willfully violates this section on three or more occasions in any six-month period shall, in addition, be subject to a civil penalty not to exceed five hundred dollars ($500) for each violation, which may be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General, by any district attorney or city attorney, or by a city prosecutor in any city or city and county having a full-time city prosecutor, in any court of competent jurisdiction.

(2) If the action is brought by the Attorney General, one-half of the penalty collected shall be paid to the treasurer of the county in which the judgment was entered, and one-half to the General Fund. If the action is brought by a district attorney, the penalty collected shall be paid to the treasurer of the county in which the judgment was entered. If the action is brought by a city attorney or city prosecutor, one-half of the penalty shall be paid to the treasurer of the city in which the judgment was entered, and one-half to the treasurer of the county in which the judgment was entered.

(e) The penalty provided by this section is not an exclusive remedy, and does not affect any other relief or remedy provided by law.

history: (History: Amended by Stats. 2009, Ch. 88, Sec. 14. (AB 176) Effective January 1, 2010.)

title: 1.82. BUSINESS RECORDS


text:
(a) “Precomputed interest” means interest, as that term is contemplated by the Truth in Lending Act, 15 United States Code 1605(a)(1), which is (1) computed by multiplying the original balance of the loan by a rate and multiplying that product by the number of payment periods elapsing between the date of the loan and the date of the last scheduled payment and (2) either added to the original principal balance of the loan in advance or subtracted from the loan proceeds.

(b) No loan which is made to a natural person primarily for personal, family, or household purposes shall provide for the payment of precomputed interest if the date on which the final installment is due, according to the original terms of the loan, is more than 62 months after the date of the loan.

(c) For purposes of determining whether a loan is covered by this title, the lender may conclusively rely on any written statement of intended purpose signed by the borrower. Such written statement may be a separate statement signed by the borrower or may be contained in a loan application or other document signed by the borrower.

(d) For purposes of this title, the term “loan” does not include the forbearance of a debt arising from a sale or lease of property and does not include any loan arising under an open end credit plan.

(e) This title shall apply only to loans made on or after January 1, 1983.

history: (History: Amended by Stats. 1980, Ch. 1380, Sec. 2. Effective October 1, 1980.)

title: 1.83. PRECOMPUTED INTEREST

path: 1.83. PRECOMPUTED INTEREST


text: Any waiver of the provisions of this title is contrary to public policy, and is void and unenforceable.

history: (History: Added by Stats. 2002, Ch. 815, Sec. 17. Effective January 1, 2003.)

title: 1.83. PRECOMPUTED INTEREST


text:
(a) “Precomputed finance charge” means a finance charge which is (1) computed by multiplying the original contract balance by a rate and multiplying that product by the number of payment periods elapsing between the date of the contract and the date of the last scheduled payment and (2) either added to the original contract balance in advance or subtracted from the contract balance.

(b) “Contract” means any agreement (1) providing for the construction, sale, or construction and sale of an entire residence, with or without a parcel of real property or an interest therein, or for the sale of a lot or parcel of real property, including any site preparation incidental to such sale, and (2) where the purchaser is a natural person who enters into such agreement primarily for personal, family, or household purposes.

(c) No contract as defined in subdivision (b) shall provide for the payment of a precomputed finance charge if the date on which the final installment is due, according to the original terms of the contract, is more than 62 months after the date of the contract.

(d) For purposes of determining whether a contract is covered by this title, the seller may conclusively rely on any written statement of intended purpose signed by the purchaser. Such written statement may be a separate statement signed by the purchaser or may be contained in a credit application or other document signed by the purchaser.

(e) This title shall apply only to contracts entered into on or after January 1, 1983.

history: (History: Added by Stats. 1979, Ch. 805.)

title: 1.84. PRECOMPUTED FINANCE CHARGE CONTRACT


history: (History: Added by Stats. 2002, Ch. 815, Sec. 18. Effective January 1, 2003.)

path: 1.84. PRECOMPUTED FINANCE CHARGE CONTRACT


text:
As used in this title:

(a) “Consumer credit contract” means any of the following obligations to pay money on a deferred payment basis, where the money, property, services or other consideration which is the subject matter of the contract is primarily for personal, family or household purposes:

(1) Retail installment contracts, as defined in Section 1802.6.

(2) Retail installment accounts, as defined in Section 1802.7.

(3) Conditional sales contracts, as defined in Section 2981.

(4) Loans or extensions of credit secured by other than real property, or unsecured, for use primarily for personal, family or household purposes.

(5) Loans or extensions of credit for use primarily for personal, family or household purposes where such loans or extensions of credit are subject to the provisions of Article 7 (commencing with Section 10240) of Chapter 3 of Part I of Division 4 of the Business and Professions Code, Division 7 (commencing with Section 18000), Division 9 (commencing with Section 22000), or Division 10 (commencing with Section 24000) of the Financial Code, whether secured by real property or otherwise.

(6) Lease contracts, as defined in Section 2985.7.

(b) “Creditor” means an individual, partnership, corporation, association or other entity, however designated, who enters into or arranges for consumer credit contracts in the ordinary course of business.

history: (History: Amended by Stats. 1997, Ch. 800, Sec. 1. Effective January 1, 1998.)

title: 1.85. CONSUMER CREDIT CONTRACTS

path: 1.85. CONSUMER CREDIT CONTRACTS